Wireshark · Ethereal-dev: Re: [Ethereal-dev] Should "dissect_tpkt_encap()" check only its "desegment" argument, rather than so

[Ulf Lamping <ulf.lamping@xxxxxx>]

Thomas Anders wrote:

> Guy Harris wrote:
>
> > Anders Broman wrote:
> >
> > > But as this question has been asked a number of times perhaps the 
> > > default
> > > should be to do reassembly. Which has been discussed but I don't 
> > > remember
> > > the arguments for and against.
> >
> >
> > My inclination is to have the default for all XXX-over-TCP dissectors be
> > "do reassembly", and the default for TCP be "don't do reassembly", so 
> > you
> > can turn off reassembly in all dissectors just by changing the TCP flag;
>
>
> That'd be helpful, agreed. But still, why shall the default for TCP be 
> "don't do reassembly"? At least all of my users would still 
> immediately want to turn it on, provided that they know about it. Do 
> most others really have different needs?

To my experience I would STRONGLY VOTE TO ENABLE ALL OF THIS REASSEMBLY 
THINGS AS DEFAULT.

That's FREQUENTLY the first thing I have to say to every new user I'll 
take care of: "go to Preferences/TCP, switch on ....."

Of course, some cons: This will slow down dissection a bit, and will use 
more memory.

This decision is basically breaking down to: fast or comfortable 
dissection. I'm voting to dissect as much as possible, and give advise 
later to speedup/reduce memory footprint if needed.

This way, new users can see the "potential" of dissection and tailor 
things down later.

Regards, ULFL